Skip to content

reGeorg

Software · ATTACK:enterprise:S1187

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1187",
  "title": "reGeorg",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1187",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--0e17b066-50dd-4c2f-83bf-205c5eb2bb34",
  "external_id": "S1187",
  "domain": "enterprise",
  "created": "2025-01-06T18:21:30.985Z",
  "modified": "2025-04-15T19:46:33.459Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Fortinet reGeorg MAR 2019",
      "url": "https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel"
    },
    {
      "source_name": "GitHub reGeorg 2016",
      "url": "https://github.com/xl7dev/WebShell/tree/master/reGeorg-master"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b918315-a5bb-4de7-b982-16d96979d428

GitHub reGeorg 2016

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3197ebd2-365b-4537-8627-600defd2044d

Fortinet reGeorg MAR 2019 · Mandiant APT29 Eye Spy Email Nov 22 · Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S1187

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41597eaa-8d5e-4fcf-aeda-a5a06df19ef7

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d64006e-74d4-488b-a396-326e51d94caf

Fortinet reGeorg MAR 2019

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5df789ae-1df2-4be4-9844-6c26b7c6d697

GitHub Neo-reGeorg 2019

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77e5b3f9-a161-487c-b31a-e3229365baf5

Fortinet reGeorg MAR 2019

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85fbeb33-0d9f-45a2-a454-1f77e51b0c4d

Fortinet reGeorg MAR 2019

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86bf339d-20a1-45c2-bad8-12b264bc7c5b

Fortinet reGeorg MAR 2019 · Mandiant APT29 Eye Spy Email Nov 22 · GitHub reGeorg 2016

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S1187

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a027e61a-5183-4a2c-9b1a-b2156f3b4546

Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddc8d1c3-0ae4-4598-b54f-df8ef2784b63

Fortinet reGeorg MAR 2019

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1308e9f-b130-4979-88ca-dbdf36e3ba78

Mandiant APT29 Eye Spy Email Nov 22 · Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S1187

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e73436ea-57f4-470b-9607-906ca6036da3

Security Affairs ANSSI APT28 OCT 2023

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e88cccd3-9559-4b33-adff-268e74bc932f

Fortinet reGeorg MAR 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.